From 613b004f70ff067bbc2d74eadc0d629240fab2e9 Mon Sep 17 00:00:00 2001
From: morthala <v.morthala@f5.com>
Date: Wed, 22 Jul 2026 10:46:58 +0530
Subject: [PATCH] Bug fix: skip retry on auth failures 401/403

---
 f5_ctlr_agent/gtm/utils.py | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/f5_ctlr_agent/gtm/utils.py b/f5_ctlr_agent/gtm/utils.py
index 67b81eb..da7f74c 100644
--- a/f5_ctlr_agent/gtm/utils.py
+++ b/f5_ctlr_agent/gtm/utils.py
@@ -483,8 +483,11 @@ def is_transient_error(exception):
         if hasattr(exception, 'response') and exception.response is not None:
             try:
                 status_code = exception.response.status_code
-                # Transient HTTP errors
-                if status_code in {401, 403, 408, 429, 500, 502, 503, 504}:
+                # Authentication failures (401/403) are PERMANENT — invalid credentials should not retry
+                if status_code in {401, 403}:
+                    return False
+                # Transient HTTP errors (server errors, rate limiting, timeouts)
+                if status_code in {408, 429, 500, 502, 503, 504}:
                     return True
                 # Permanent HTTP errors
                 if status_code in {400, 404, 409, 422}:
@@ -498,6 +501,9 @@ def is_transient_error(exception):
         
         # Permanent patterns — NEVER retry
         PERMANENT_PATTERNS = (
+            # Authentication failures — invalid credentials
+            '401', '403', 'unauthorized', 'forbidden',
+            # Not found / Invalid config
             '404', 'not found', 'does not exist',
             'was not found', 'is not valid', 'is not allowed',
         )
@@ -506,8 +512,6 @@ def is_transient_error(exception):
         
         # Transient string patterns
         TRANSIENT_PATTERNS = (
-            # Auth (session expired, token stale)
-            '401', '403',
             # Server errors
             '500', '502', '503', '504',
             # Connection errors